WordPress readme.html File Exposed
The default readme.html discloses your exact WordPress version, handing attackers a targeted exploit list.
What is WordPress readme.html File Exposed?
Every WordPress ship includes readme.html at the site root, and its headline text contains the exact version number ("Version 6.x"). Bots and attackers request it as free reconnaissance: knowing the precise core version lets them match your site against public vulnerability databases and fire only the exploits that work. The same information leaks from the generator meta tag and RSS feeds unless removed. On its own, version disclosure is a low-severity information leak — but it is an enabler for every WordPress core vulnerability that follows, and removing it takes one delete or one server rule.
Why It Matters to Your Business
Version disclosure turns your site from "unknown WordPress" into "WordPress 6.x with known issues" in one request. Combined with an update gap of even a few weeks, that precision matters: mass-exploitation campaigns scan for exact versions before firing exploits. Removing readme.html plus the generator tag removes the cheapest reconnaissance signal attackers have about your stack.
How to Fix It
1. Delete readme.html from the web root (it is a static file — deleting breaks nothing):
rm /var/www/yoursite/readme.html
NOTE: WordPress core updates recreate it — so also add the server rule (step 2).
2. Block it permanently at the server level:
Nginx:
location = /readme.html { deny all; return 404; }
Apache (.htaccess):
<Files readme.html>
Require all denied
</Files>
3. Remove the version from page source too:
add to functions.php of the theme or a small plugin:
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');
4. The real fix is staying updated: core, plugins, themes. Version hiding reduces targeting but patching removes the vulnerability.
Frequently Asked Questions
Why does exposing my WordPress version matter?
It lets attackers match your site exactly against public vulnerability lists and fire only proven exploits for your version. Alone it is minor; combined with a delayed update it is the targeting data every mass campaign starts with.
Will deleting readme.html break anything?
No — it is a static informational page nobody links to. Delete it and add the server block, because WordPress core updates recreate the file.
What else leaks my WordPress version?
The generator meta tag in page HTML, RSS/Atom feeds, and version query strings on asset URLs. The wp_hardening scanner reports all of them.
Technical Classification
| OWASP Category | A05:2021 — Security Misconfiguration |
| CWE ID | CWE-200: Exposure of Sensitive Information |
| Detected By | wp_hardening, sensitive_paths scanner(s) |
| Severity Level | low |
How 2MNY Security Can Help
Check if your website has this vulnerability
Our wp_hardening, sensitive_paths scanner checks for this issue automatically.
Scan My Website FreeRelated Vulnerabilities
Outdated CMS Version
The CMS (WordPress, Joomla, Drupal) is running an outdated version with known security vulnerabilities.
Vulnerable JavaScript Library
The site uses an outdated JavaScript library (jQuery, Lodash, Bootstrap, Angular) with known vulnerabilities.
Default CMS Install Page Exposed
The CMS installer (install.php, setup wizard) is still reachable, letting anyone re-run it and take over the site.
WordPress XML-RPC Interface Enabled
xmlrpc.php is enabled, giving bots a brute-force amplifier (system.multicall) and a pingback abuse surface.